| Date | Wed, 21 Jul 2021 00:04:46 +0200 | From | Pavel Machek <> | Subject | Re: [PATCH 5.10 074/243] iommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get fails |
| |
Hi!
> From: Xiyu Yang <xiyuyang19@fudan.edu.cn> > > [ Upstream commit 1adf30f198c26539a62d761e45af72cde570413d ] > > arm_smmu_rpm_get() invokes pm_runtime_get_sync(), which increases the > refcount of the "smmu" even though the return value is less than 0.
Yes.
> The reference counting issue happens in some error handling paths of > arm_smmu_rpm_get() in its caller functions. When arm_smmu_rpm_get() > fails, the caller functions forget to decrease the refcount of "smmu" > increased by arm_smmu_rpm_get(), causing a refcount leak.
Yes, some error paths do that. But some callers (arm_smmu_map, arm_smmu_unmap, arm_smmu_flush_iotlb_all, ...) ignore return value of arm_smmu_rpm_get().
> Fix this issue by calling pm_runtime_resume_and_get() instead of > pm_runtime_get_sync() in arm_smmu_rpm_get(), which can keep the refcount > balanced in case of failure.
So no, this is not fixed; it is just unbalanced in the other (more dangerous) direction now.
Best regards, Pavel
-- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany [unhandled content-type:application/pgp-signature] |